MCP SSDLC Security Toolkit
Generates CI/CD pipeline configurations for Bitbucket repositories, enabling automated builds and deployments.
Generates Dockerfile and docker-compose configurations for containerized deployment of the designed system.
Generates CI/CD pipeline configurations for GitHub Actions, enabling automated testing and deployment workflows.
Generates CI/CD pipeline configurations for GitLab CI, enabling automated builds and deployments.
Generates Kubernetes deployment manifests (e.g., Deployments, Services) for orchestrating containerized applications.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCP SSDLC Security Toolkitorchestrate SSDLC pipeline for HIPAA-compliant app"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP SSDLC Security Toolkit v2.0
An intelligent, domain-aware Security Software Development Life Cycle (SSDLC) toolkit powered by the Model Context Protocol (MCP). It helps Tech Leads, Security Engineers, and Developers orchestrate secure software design, generate pseudocode, and manage compliance.
π Key Features
Domain-Agnostic Core: Built-in support for Healthcare (HIPAA), Fintech (PCI-DSS), Blockchain, Secure Communications, and 12+ more domains. Easily extensible to ANY domain via YAML plugins.
Tech Lead Automation: Generates Pseudocode (Python, TS, Java, Go, C#, C++, Rust), Architecture Diagrams (Mermaid), DFD/ERD, and Module Breakdowns from user stories.
Full Pipeline Orchestration: One command to run BA β Tech Design β Threat Modeling β QA Strategy β CI/CD Planning β ADR Generation.
Multi-format Export: Output to JSON, YAML, Markdown, or professional SRS documents.
Related MCP server: Phantom MCP
π Table of Contents
π Getting Started
Prerequisites
Node.js v18+
pnpm (recommended) or npm
Installation
# Clone the repository
git clone https://github.com/vuongdat67/mcp_ssdlc
cd mcp-ssdlc-security-toolkit
# Install dependencies
pnpm install
# Build the project
pnpm buildπ» Configuration
Claude Desktop App
Add to your Claude Desktop configuration:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"ssdlc-toolkit": {
"command": "node",
"args": ["path/to/mcp-ssdlc-security-toolkit/dist/index.js"]
}
}
}VS Code
The project includes .vscode/mcp.json for automatic configuration.
Docker
# Build and run with Docker
docker build -t mcp-ssdlc-toolkit .
docker run -it mcp-ssdlc-toolkit
# Or use docker-compose
docker-compose up ssdlcπ οΈ Available Tools
Tool | Description |
| List all available domain plugins |
| Load a specific domain |
| Auto-detect domain from description |
| Generate user stories and security requirements |
| Generate technical design and pseudocode |
| Generate STRIDE threat model |
| Generate test strategy |
| Generate CI/CD pipeline |
| Run complete SSDLC pipeline |
π Domains
Built-in Domains
Domain | Compliance | Use Case |
| HIPAA | Patient records, telemedicine |
| PCI-DSS | Payments, banking |
| - | Smart contracts, DeFi |
| GDPR | E2EE messaging |
| OWASP | Security tooling |
| - | ML model security |
| - | Malware research |
And 10+ more... |
Custom Domains
Create custom domains by adding YAML files to domains/custom/:
# domains/custom/ecommerce/domain.yaml
name: "ecommerce"
keywords: ["shop", "cart", "checkout"]
stakeholders:
- name: "Shopper"
type: "end_user"
sensitiveData:
- type: "Payment Data"
level: "critical"π³ Docker
# Development mode
docker-compose up ssdlc-dev
# Production mode
docker-compose up ssdlc
# Run tests
docker-compose run testπ Documentation
Full documentation available in the docs/ directory:
π€ Contributing
We welcome contributions! See CONTRIBUTING.md for guidelines.
# Run tests
pnpm test
# Run with coverage
pnpm test:coverage
# Lint
pnpm lintπΊοΈ Roadmap
See ROADMAP.md for planned features:
v2.1: AI Integration, Interactive CLI, Domain Marketplace
v2.5: Real-time Collaboration, Version Control, Third-party Integrations
v3.0: Visual Domain Designer, SBOM, Threat Intelligence Feeds
π οΈ Tech Stack
Feature | Supported Options |
Pseudocode Language | Python, TypeScript, Java, Go, C#, C++, Rust |
Cloud Target | Kubernetes, AWS, Azure, GCP, Docker |
Repo Platform | GitHub, GitLab, Bitbucket |
Export Formats | JSON, YAML, Markdown, SRS |
π€ Orchestration Example
Ask your AI assistant:
"Design a secure E-wallet system for fintech. Use TypeScript and deploy to AWS. Run the full SSDLC pipeline."
The agent will call orchestrate_ssdlc_pipeline and generate:
User stories and security requirements
Technical design with pseudocode
STRIDE threat model
Test strategy
CI/CD pipeline
Architecture Decision Records (ADRs)
Project plan with cost estimation
π License
This project is licensed under the MIT License - see the LICENSE file for details.
Made with β€οΈ by the MCP SSDLC team
Available Tools
17 toolsanalyze_code_securityC
Analyze code for security issues and vulnerabilities
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | Code to analyze | |
| domain | No | Domain context (healthcare, fintech, etc.) | |
| language | Yes | Programming language |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as whether it is read-only, requires network access, or has side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, clear sentence without unnecessary words. It is appropriately concise, though could benefit from a bit more detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is provided, and the description does not explain the output format, types of issues detected, or how to interpret results. This leaves significant gaps for a security analysis tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for each parameter. The tool description adds no additional meaning beyond the schema, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it analyzes code for security issues and vulnerabilities, but does not differentiate from similar sibling tools like 'security_threat_model' or 'get_secure_template'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. No mention of prerequisites, limitations, or recommended scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ba_analyze_requirementsC
Generate user stories, security requirements, and abuse cases
| Name | Required | Description | Default |
|---|---|---|---|
| domain_name | No | Optional domain name | |
| business_goals | Yes | ||
| project_description | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries full burden. It only lists outputs but does not disclose any behavioral traits such as side effects, authorization needs, or constraints. The tool's behavior regarding data persistence or generation style is not mentioned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words. However, it is minimal could benefit from slight expansion to cover usage context without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has 3 parameters (2 required) and no output schema. The description does not explain how parameters map to outputs or what the generated artifacts look like. For a complex generation task, more context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 33% (only 'domain_name' has a description). The description does not add meaning to parameters beyond their names. For example, 'business_goals' and 'project_description' are not elaborated on format or expected content.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb (Generate) and resource (user stories, security requirements, abuse cases). It specifies the outputs but does not differentiate from sibling tools like 'analyze_code_security' or 'security_threat_model' which may produce similar requirements.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Does not mention prerequisites, context, or when not to use it. Sibling tools exist with overlapping functionality, yet no distinction is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
detect_domainC
Auto-detect domain from project description
| Name | Required | Description | Default |
|---|---|---|---|
| project_description | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description does not disclose side effects (e.g., whether it creates a domain), required permissions, or outcome. Agent cannot determine if call is safe or modifies state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence front-loads action, but is too concise for an agent to make reliable use-call decisions. Lacks necessary details while being short.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and only one parameter, description should clarify return value (e.g., domain name, confidence score) and constraints. Completely absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% coverage for parameter descriptions. Description adds 'from project description' but does not specify expected format, length, or constraints. Parameter name alone is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states verb 'auto-detect' and resource 'domain' with input 'project description', indicating basic purpose. However 'domain' is ambiguous (could be internet domain or application domain) and does not distinguish from siblings like list_domains or load_domain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like list_domains or load_domain. Agent must infer usage solely from vague description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
devops_design_cicdC
Generate CI/CD pipeline with security gates
| Name | Required | Description | Default |
|---|---|---|---|
| tech_stack | No | ||
| project_name | No | ||
| deployment_target | No | ||
| repository_platform | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It only states the tool 'generates a pipeline' without detailing what the generation entails, authorization needs, or output characteristics. This is minimal disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that states the core purpose. It is front-loaded but lacks supporting details. It is not unnecessarily verbose, but it does not provide enough information to be considered well-structured or fully informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With four parameters, no annotations, no output schema, and only a terse description, the tool definition is severely incomplete. The agent has almost no guidance on how to use the parameters or what to expect from the tool's output, making it difficult to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any of the four parameters (tech_stack, project_name, deployment_target, repository_platform). The schema provides enum values for some parameters, but the description adds no semantic help beyond the parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a CI/CD pipeline with security gates, which is a specific verb and resource. It distinguishes from sibling tools like analyze_code_security or get_coding_guidelines, though it does not explicitly compare to alternatives like orchestrate_ssdlc_pipeline.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings such as orchestrate_ssdlc_pipeline or security_threat_model. There is no mention of prerequisites, scenarios, or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_coding_guidelinesC
Get coding guidelines and security rules for a domain
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name | |
| language | Yes | Programming language |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavior. It implies a read operation but does not specify error handling (e.g., when domain or language is invalid), authentication requirements, rate limits, or any side effects. For a retrieval tool, details on result format or potential absence of data are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at one sentence and eight words. It front-loads the core purpose, but omits usage guidance and behavioral details that could justify additional length. For a minimal viable description, it is efficient but could include a brief usage hint without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and annotations, the description fails to provide necessary context. It does not explain what the tool returns (e.g., a list of rules, formatted text, or JSON), how to handle missing data, or any constraints. For a retrieval tool with two parameters, the description is insufficient for an agent to use it reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters are fully described in the schema with clear, self-explanatory descriptions ('Domain name', 'Programming language'). The tool description adds no additional nuance beyond the schema, so the baseline score of 3 is appropriate for 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool retrieves coding guidelines and security rules for a domain, using specific verbs and resources. It distinguishes from sibling tools like analyze_code_security or security_threat_model, which focus on analysis rather than retrieval. However, it could be more precise about what constitutes 'guidelines' and 'security rules'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings. There is no mention of prerequisites, typical scenarios, or cases where alternatives like analyze_code_security or security_threat_model would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_last_known_goodC
Get last known good configuration that worked
| Name | Required | Description | Default |
|---|---|---|---|
| workspace_root | Yes | Workspace root directory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the burden of behavioral disclosure. It only states the basic action without mentioning side effects, permissions, or what happens when no good config exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no wasted words. It is appropriately front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the minimal description and lack of output schema, the definition is incomplete. It does not clarify what 'last known good' means or what the return value is.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a description for workspace_root. The tool description adds no additional semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action (get) and resource (last known good configuration). It is specific enough to convey the core function, though it does not distinguish from sibling tools like workspace_snapshot.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. There is no mention of prerequisites, context, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_secure_templateC
Get a secure code template for a feature type
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | Domain context | |
| language | Yes | ||
| feature_type | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, and the description does not disclose behavioral traits such as side effects, authorization requirements, or whether the tool is read-only. The description merely states the operation without additional context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but incomplete. It lacks structure, such as separating purpose from usage notes, and does not use the limited space effectively to convey necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, 3 parameters with low schema coverage, and no annotations. The description fails to explain return values, error handling, or usage patterns, making it insufficient for an agent to understand the tool's full behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 33% schema description coverage, the tool description adds no meaning beyond the schema. It does not explain the purpose of 'domain', 'language', or 'feature_type' parameters. The schema's description for 'domain' ('Domain context') is vague, and the tool description fails to elaborate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Get a secure code template for a feature type', which clearly identifies the verb ('get') and resource ('secure code template'). It distinguishes from sibling tools that focus on analysis, design, or diagnostics. However, it doesn't specify what type of template or its format.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description lacks context about prerequisites, appropriate feature types, or when to prefer this over other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_domainsB
List all available domain plugins
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full responsibility for behavioral disclosure. It fails to mention that this is a read-only operation, whether it requires authentication, or what 'available' means in terms of state (e.g., installed, enabled). The agent is left to assume it is safe and fast.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence that communicates the core functionality without any unnecessary words. It is appropriately sized for a simple list operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no output schema), the description is largely complete. It could marginally benefit from clarifying what 'domain plugins' are and whether the list reflects system status or user context, but current level is sufficient for a basic list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (effectively). According to guidelines, zero parameters earns a baseline of 4. No additional parameter information is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and resource ('all available domain plugins'). It is explicit enough to distinguish from sibling tools like 'detect_domain' or 'load_domain'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as 'detect_domain' or 'load_domain'. The description does not mention prerequisites, context, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
load_domainC
Load a specific domain plugin
| Name | Required | Description | Default |
|---|---|---|---|
| domain_name | Yes | Domain name (healthcare, fintech, generic) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility. It only states 'Load', giving no indication of side effects, permissions required, or what happens after loading. This is insufficient for a tool that likely mutates state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise. However, it may be too terse and lacks structured detail. It could benefit from elaboration without being overly long.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one required parameter, no output schema, and no annotations, the description should provide more context about what a domain plugin is, what loading entails, and expected outcomes. It falls short.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (the parameter domain_name is described). The main description adds no extra meaning beyond the schema; the schema already lists example values. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Load') and the resource ('a specific domain plugin'). It is specific enough but does not differentiate from sibling tools like 'detect_domain' or 'list_domains', which have overlapping themes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, context, or scenarios where loading a domain plugin is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
orchestrate_ssdlc_pipelineC
Run complete SSDLC pipeline from project description
| Name | Required | Description | Default |
|---|---|---|---|
| tech_stack | Yes | ||
| business_goals | Yes | ||
| target_language | No | ||
| deployment_target | No | ||
| project_description | Yes | ||
| compliance_requirements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description implies a potentially long-running or destructive process but offers no details on side effects, required permissions, or what changes are made.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence is concise but lacks substance. It could be expanded to include key details without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 6 parameters, no output schema, and no annotations, the description fails to explain the pipeline's behavior, outputs, or parameter roles. Severely incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description only mentions 'project description' but ignores five other parameters including enums. No meaning added beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'run' and the resource 'complete SSDLC pipeline', differentiating it from sibling tools like 'analyze_code_security' or 'techlead_design'. However, it lacks specificity on what the pipeline entails.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'techlead_design' or 'security_threat_model'. No prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
parse_error_logC
Parse error log to extract issues and suggestions
| Name | Required | Description | Default |
|---|---|---|---|
| log_type | No | Type of log | |
| log_content | Yes | Error log content to parse |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. It implies a read-only operation ('parse'), but does not explicitly state it is non-destructive, safe, or free of side effects. The lack of explicit safety disclosure reduces transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that conveys the core purpose without unnecessary words. It is appropriately sized but could benefit from slightly more detail, hence not a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 2 simple parameters and no output schema. The description gives the overall purpose but does not mention output format or what 'issues and suggestions' entails. With several sibling tools, additional context would improve completeness, but it is minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters described (log_content and log_type). The description adds no extra meaning beyond these schema descriptions. Baseline score of 3 is appropriate as the schema already conveys parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Parse error log to extract issues and suggestions'. The verb 'parse' and resource 'error log' are specific, and it distinguishes from sibling tools like analyze_code_security or detect_domain. However, it does not specify the type of issues or suggestions, leaving some ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as when to choose it over analyze_code_security or run_diagnostic_playbook. It solely states the function without contextual usage cues.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
qa_design_test_strategyC
Generate test cases from features and threats
| Name | Required | Description | Default |
|---|---|---|---|
| threats | No | ||
| features | No | ||
| compliance_requirements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It merely states 'generate test cases' without disclosing whether the tool is read-only, destructive, requires authentication, or what the output format is. This is insufficient for a tool with no annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise, but it omits critical information. It is not overly verbose, but the brevity comes at the cost of completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 3 undocumented parameters, no output schema, and no annotations. The description does not explain how test cases are generated, what the output looks like, or any dependencies. It is far from sufficient for correct use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description should explain the parameters. It lists 'threats', 'features', and 'compliance_requirements' but provides no details on their structure or expected values. The agent cannot infer proper inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: 'Generate test cases from features and threats'. It specifies the verb (generate) and resource (test cases). However, it does not distinguish this tool from siblings like security_threat_model, which might also involve threats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, when not to use it, or suggest which sibling tools might be more appropriate for related tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_diagnostic_playbookC
Run a diagnostic playbook to check/fix environment issues
| Name | Required | Description | Default |
|---|---|---|---|
| playbook | Yes | Playbook to run | |
| workspace_root | Yes | Workspace root directory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It mentions 'fix' implying mutation, but does not disclose whether the tool modifies the environment, requires permissions, or has side effects. Important behavioral details are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and contains no redundant words. It is appropriately sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and the tool's potential to modify the environment, the description is incomplete. It does not explain what the tool returns, whether it is idempotent, or any post-conditions. More context is needed for safe usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the parameter descriptions are minimal. The description adds no extra meaning beyond the schema (e.g., explaining enum values or workspace_root usage). A baseline of 3 is not earned because the description fails to clarify parameter behavior or selection criteria.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a diagnostic playbook to check/fix environment issues, with a specific verb and resource. However, it does not differentiate from the sibling tool 'run_environment_diagnostics', which likely has overlapping functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., run_environment_diagnostics, parse_error_log), nor are prerequisites or situational use cases mentioned. The description lacks explicit usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_environment_diagnosticsC
Run diagnostics to check development environment (Node, Git, build tools)
| Name | Required | Description | Default |
|---|---|---|---|
| workspace_root | Yes | Workspace root directory |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavioral traits. Only states 'run diagnostics' without indicating side effects, return format, or whether it modifies anything. For a diagnostic tool, read-only behavior should be explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, no unnecessary words. Concise and front-loaded with the action and target, though additional detail would improve its utility.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is too minimal. It does not explain output format, error handling, or how to interpret results, which is crucial for a diagnostic tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single self-explanatory parameter 'workspace_root'. Description does not add extra meaning beyond the schema, but baseline is 3 due to high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'run diagnostics' and lists the components checked (Node, Git, build tools). Distinguishes from sibling 'run_diagnostic_playbook' by specifying development environment focus, but could be more precise about the scope of diagnostics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like 'run_diagnostic_playbook' or prerequisites. Does not mention cases where diagnostics might fail or when to avoid running.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
security_threat_modelC
Generate STRIDE threat model from modules
| Name | Required | Description | Default |
|---|---|---|---|
| modules | No | ||
| domain_name | No | ||
| project_name | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description bears full burden. It only says 'generate a STRIDE threat model from modules' but does not disclose behavioral traits like whether it is read-only, requires prerequisites, or what side effects occur.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence and front-loaded, which is concise. However, it is under-specified for the tool's complexity, so it does not earn full marks for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 0% schema description coverage, no output schema, and no annotations, the description is insufficient. It fails to explain return values or parameter usage, making it incomplete for an agent to use effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no information about parameters. It does not explain what 'modules', 'domain_name', or 'project_name' mean, leaving the agent without necessary context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Generate' and resource 'STRIDE threat model', clearly indicating the tool's function. It distinguishes from sibling tools like 'analyze_code_security' by focusing on threat modeling, but does not explicitly differentiate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description only states the action without providing context for appropriate use cases or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
techlead_designC
Generate feature checklist, flows, modules, pseudocode, architecture diagram
| Name | Required | Description | Default |
|---|---|---|---|
| project_name | No | ||
| user_stories | No | ||
| export_format | No | ||
| target_language | No | ||
| security_requirements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states what the tool generates but reveals nothing about side effects, permissions required, input expectations, or output format. For a tool producing multiple artifacts, more behavioral context (e.g., whether it saves to workspace, what happens with missing inputs) is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently lists the key outputs. It is front-loaded with the verb and target items. However, it could be slightly more structured (e.g., separating input expectations from outputs) without adding length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 optional parameters, no output schema, and 16 sibling tools, the description is incomplete. It doesn't specify what the tool returns, how parameters affect behavior, or how it fits into a design workflow. For example, users don't know if 'export_format' controls the output or if 'target_language' changes pseudocode style.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not mention any parameters, while the schema has 5 parameters (including project_name, user_stories, export_format) with 0% schema description coverage. The description adds no meaning beyond the schema; it fails to explain how parameters like 'user_stories' or 'security_requirements' influence the generated design.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the verb 'Generate' and lists specific outputs (feature checklist, flows, modules, pseudocode, architecture diagram), making the tool's purpose clear. However, it does not differentiate from similar sibling tools like 'ba_analyze_requirements' or 'qa_design_test_strategy', missing a chance to specify its unique scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. For example, it doesn't clarify whether this tool is for initial design vs. detailed implementation, or when to prefer it over sibling tools like 'security_threat_model'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_snapshotA
Generate a snapshot of the workspace structure (file tree with .gitignore filtering)
| Name | Required | Description | Default |
|---|---|---|---|
| max_depth | No | Maximum depth to scan (default: 5) | |
| root_path | Yes | Root directory to scan |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. It mentions '.gitignore filtering' which specifies a key behavior, but does not disclose potential side effects (e.g., read-only, performance for large directories) or whether it follows symlinks. Adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the action ('Generate a snapshot') and adds the key filtering context. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has only two parameters and no output schema. The description covers the main output behavior (file tree with gitignore filtering), which is likely sufficient for an agent to understand what to expect. Minor gaps: no mention of output format or depth limitations beyond the optional max_depth parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not add extra meaning to the parameters beyond what the schema already provides (root_path and max_depth are self-explanatory in the schema).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Generate' and a clear resource 'snapshot of workspace structure (file tree with .gitignore filtering)'. It distinguishes itself from sibling tools which are mostly analysis/design-oriented, making its purpose distinct and easy to understand.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives (like get_coding_guidelines or parse_error_log). While it may be a prerequisite for workspace analysis, this is not explicitly stated, leaving the agent without explicit selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
17 tool updates
v2.0.0- First observed
analyze_code_security - First observed
ba_analyze_requirements - First observed
detect_domain - First observed
devops_design_cicd - First observed
get_coding_guidelines - First observed
get_last_known_good - First observed
get_secure_template - First observed
list_domains - First observed
load_domain - First observed
orchestrate_ssdlc_pipeline - First observed
parse_error_log - First observed
qa_design_test_strategy - First observed
run_diagnostic_playbook - First observed
run_environment_diagnostics - First observed
security_threat_model - First observed
techlead_design - First observed
workspace_snapshot
TDQS
Most tools have clearly distinct purposes, but there is minor overlap between run_diagnostic_playbook and run_environment_diagnostics, and between get_coding_guidelines and get_secure_template. Descriptions are clear enough to differentiate.
The majority of tools follow a consistent verb_noun pattern (e.g., analyze_code_security, list_domains). However, two tools (security_threat_model, workspace_snapshot) deviate by omitting a verb, creating a minor inconsistency.
With 17 tools, the server is well-scoped for a security toolkit covering requirements, design, threat modeling, code analysis, CI/CD, testing, diagnostics, and domain management. Each tool earns its place.
The toolset covers major SSDLC phases (requirements, design, implementation guidance, analysis, testing, CI/CD). Minor gaps exist, such as lack of deployment security scanning or compliance checks, but core workflows are supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.
Governance copilot for AI-assisted coding. 72 packs, 532 rules, proof bundles.
DORA OS Conductor β 16-tool meta-orchestrator for DORA compliance workflow automation.
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
1
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceIntegrates SAST, DAST, IAST, and SCA security testing tools for AI-powered DevSecOps automation, enabling comprehensive security scanning and reporting through natural language interfaces.17MIT
- FlicenseNot gradedqualityDmaintenanceEnables authorized compliance verification and security auditing through natural language, bridging AI assistants with industry-standard security tools for enterprise audits.24-
- AlicenseNot gradedqualityDmaintenanceEnables AI-powered security scanning of codebases through conversational analysis, allowing users to assess, threat model, code review, DAST test, and generate security reports using natural language with Claude.MIT
- AlicenseNot gradedqualityBmaintenanceIntegrates authoritative security compliance frameworks (ISO 27001, NIST 800-53, OWASP ASVS, NIST SSDF) into AI-assisted development, offering control lookups, cross-framework mappings, build-time guardrails, and automated audit evidence generation.1693MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/vuongdat67/mcp_ssdlc'
If you have feedback or need assistance with the MCP directory API, please join our Discord server